Improper verification of cryptographic signature (CWE-347) in wwwupdate.cgi of the MBS Universal BACnet Router firmware before V6.0.1.0. The update handler sanitises the user-controlled filename to prevent path traversal and verify file extensions, but then passes the result unsanitised to gpg. By crafting a filename such as "-h f.upd", an attacker can make GPG return success without actually checking a signature, allowing an unsigned or maliciously signed .upd file to be placed in /updates/. A remote attacker with admin-level web credentials or a stolen session token can exploit this to upload a rogue firmware update and gain persistent root access on the device.

MBS vendor advisory: MBS-2025-0001.